CVE-2020-14330: Medium severity red hat ansible engine vulnerability
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-14330?
CVE-2020-14330 is an Improper Output Neutralization for Logs flaw in Ansible.
What is the severity of CVE-2020-14330?
The severity of CVE-2020-14330 is medium with a CVSS score of 5.5.
How does CVE-2020-14330 affect Ansible?
CVE-2020-14330 affects Ansible when using the uri module, exposing sensitive data to content and json output.
What are the affected software versions for CVE-2020-14330?
The affected software versions for CVE-2020-14330 include Ansible Engine up to version 2.9.12 and Debian Linux version 10.0.
How can I fix CVE-2020-14330?
To fix CVE-2020-14330, update Ansible to version 2.7.7+dfsg-1+deb10u1, 2.10.7+merged+base+2.10.8+dfsg-1, 7.3.0+dfsg-1, or 7.7.0+dfsg-3.